13

On Tuesday something very strange happened and I haven't been able to definitively work out how.

I returned to the LastPass app on my iPhone where I'd been using the builtin browser. It's pretty clean since I only use it for sites where I log in directly from the 'Vault'.

The first mystery: on re-opening the browser, a page titled "PlayOGame" was loading in the foreground tab advertising some games.

A web page signed up my mobile number to a premium rate subscription

Immediately after page load (and I don't believe I clicked on this page), I received an SMS saying "You have subscribed to PLAYOGAME...".

Screenshots of page and SMS

EE couldn't tell me how it works

I phoned my provider - EE in the UK - who told me I had subscribed to this service by clicking on a link.

I asked how the company got my number (e.g. how EE gave it to them) - and he replied confidently "it's the way internet works - websites can get your number through your data signal" ... (lol) ... which wasn't quite how I understood things...

The ad company couldn't tell me how it works

I got a similarly confused answer from Payguru, the company I had 'subscribed' to (who apparently hadn't heard of PlayOGame but were able to unsubscribe me). She told me that "98% of links on the internet are chargeable". Right.

I did manage to learn the payment mechanism is called "direct carrier billing" and that "one click on a website is sufficient to authorize payment"

The premium rate number REGULATOR couldn't tell me how it works

Finally I complained to the Phone-paid Services Authority - the UK regulator - who patiently recorded my complaint, but had no idea what I was talking about.

Is EE doing 'header enrichment'?

My first thought was this was like when O2 were 'accidentally' adding users' MSISDNs to every HTTP request.

I've subsequently learned this is called 'header enrichment' (implying this perhaps wasn't an accident). There are shady-looking forums talking about this alongside "one-click payment flows" and "msisdn recognition".

I inspected my outgoing HTTP headers in a requestbin and couldn't see any unusual headers. I tried the same with cookies using httpbin.org/cookies but nothing strange there either.

I found a couple of papers on this:

In both papers they were able to detect these headers on their own webservers, but I am not... why not?

Could it be that EE are selectively sending headers only to advertisers, to make it harder to detect this behaviour? Is there another method I haven't thought of?

Does anyone have any insight on how this works?

In the mobile space delivering the right ad to the right person is difficult because there is no common standard for identity and addressability. We think we’re in a position to solve that. The second piece is the measurement of mobile; there are a lot of problems with getting good attribution data.

C. Hillier, VP of Verizon’s Precision Market Insights division

Edit: Update: PlayOGame's website

I found PlayOGame's website (visit with care! http://playogame.center) in LastPass's history (duh).

They're a company called AKMobile in Azerbaijan:

Organization: AKMobile LLC
Street: Khojali Avenue, Baku, Azerbaijan
City: Baku
State/Province: Baku
Postal Code: AZ1025
Country: AZ

It's not clear who is behind them, but this is in the Privacy Policy:

Log Data

Like many site operators, we collect information that your browser sends whenever you visit our Site ("Log Data").

This Log Data may include information such as your mobile number (MSISDN), browser type, browser version, the pages of our Site that you visit, the time and date of your visit, the time spent on those pages and other statistics.

Improve this question
4

3 Answers 3

Reset to default
3

It happens that you incurred in a fraud that is actually very common and requires a bit of carrier's technical cooperation. I know that it happened in Italy (source: Antitrust Authority), especially to Three users.

Premium-SMS services allow external content providers to provide mobile subscribers with SMS content that is supercharged, with charges divided between the provider and the carrier (as a fee for networking and payment processing costs). User is debited on his number, either pre-paid or subscribed.

It works essentially by technical arrangements with carrier providers, for which I could find no documentation. I am 80% sure that is a huge NDA barrier to see the technical APIs for premium services providers to carriers.

I have already seen a number of mobile carriers providing non-login access to self care portal when you are connected to their network, e.g. not using Wifi at home. Mostly all available in my country. They do authenticate you by ip address, which also means that anyone tethering on you may see remaining credit or data treshold. So it is not uncommon.

What EE ad other carriers might do without you to find out is selective transparent proxying, which explains why the second paper could be "outdated" to our scope.

Carrier might add the tracking header to HTTP requests targeting their partners' servers only. But I have no proof over it. I doubt that they can technically assign a unique IPv4 address to every device.

Consider that premium SMS services are not actually delivered by the Azerbaijani company (which tells most of the truth about the liability chain, with the highest respect to honest people born and living Azerbaijan), but from a company that has partnership agreements with the carrier. Consider this company I found during my search selling premium SMS services.

Consider also that to my knowledge carriers only charge for premium SMS received. This means that the carrier has no knowledge (or "row in their database") for subscription. If you have subscribed for 5£/week, that means you will get a weekly 5£ text saying "Your subscription is renewed". To summarize, your weekly charge is associated to that SMS, and in case network does not deliver (or realistically delays) that SMS you are free from any charge until you receive it.

It is important to note that not everyone can send a premium SMS to subscribers and get money. Carriers do make agreements (and open logical channels) only with companies they trust in order to avoid a massive SMS bombing, for which the carriers are responsible under all consumer regulations. The mechanism starts to break when those SMS providers allow other companies to be their premium SMS customers (right wording is suppliers) and do not enforce careful checks on their ability to start a subscription without explicit user confirmation.

From my experience with the Italian case, for which police investigations are slowly ongoing, particularly slow in this case, public opinion's conclusions are that 1) there is a lot of money involved in the premium SMS stuff, as carriers take a lot of fees, 2) the impact is divided in small fractions across multiple individuals, so the damage to the single customer is trivial, and 3) a lot of subscribers are hardly aware of being victim of the premium SMS scam, including a person I know in person who paid 5€/week for nothing. N. O. T. H. I. N. G. actually delivered to that person's phone. (see note 1)

The real supply chain, from EE, O2 or any other provider, to the Azerbaijani company can be as longer as you like. Matrioska-style chains are not uncommon.

Conclusions

You were surely victim of an ongoing scam that leverages the trust between the carrier and their partner networks, allowing their technical APIs to estabish a subscription without SMS confirmation. Not applicable to all carriers. Occurred with Three Italy with ease as described in linked article.

Often the advertising system is designed that your subscription starts when you click on a "I agree" button, but that click is stolen with common clickjacking techniques.

Your phone number was not necessarily leaked to advertising provider, but to content provider. Advertising provider knows your ISP.

You may demand your money back to your provider claiming you did not consent to the subscription. Under your regulation, the opposition of your carrier that you have clicked "I agree" may be their burden to prove.

To my records, EU-regulated carriers should allow their customers to block all kinds of premium services by explicitly opting out from any future subscription. This has pros and cons. (e.g. you won't buy your bus ticket by SMS)

You can sue John Doe at your local police office, citing all information that suggests this specific content provider is scamming other people is also worth. Remember that you have been stolen only a small amount of money, and your local prosecutor must consider this.

Adding my linked article from Italian Antitrust to your complain at Phone Services Authority may help, so they are informed that a similar case occurred in another EU country.

Spreading the word with the help of a consumer association (I am thinking about the equivalent of American ACLU) may help start an investigation.

Note 1:

Why nothing delivered? I tracked all the SMSes received by this person's 3g modem and when I found traces of the subscription to the premium service I never saw any method to retrieve the "contents" that were weekly available. Every SMS "This week new content for you". What is the "content"? How do I see that?

Improve this answer
2

Unfortunately, there is no way to conclusively answer this question with the information available.

Your test case is invalid.

It appears you looked at the headers sent to the RequestBin web site. Even O2 admitted that they could selectively insert the headers. You cannot assume RequestBin is receiving the same headers that PlayOGame did.

To truly verify HTTP headers are not involved, you need to capture traffic on PlayOGame's network interface. It is possible for a carrier's proxy to modify the headers unless everything is done over HTTPS.

Tech support and customer service don't know.

A long time ago, I worked in a tech support center. Getting technical details on infrastructure outside of my immediate scope of support was virtually impossible in most cases.

Call center supervisors often discourage such knowledge-seeking because they are far more interested in completing the customer interaction quickly rather than providing accurate information.

There is insufficient data.

The logs between your device and playogame.center would be necessary to identify the fully what data was transferred. It is conceivable that they ran a script to gather the data from your device, which would not show in the headers at all. That would likely require an exploit---as far as I know, neither iOS nor Android exposes IMSI or MSISDN in any way by default.

Additional testing

The only way to prove that your device didn't disclose your phone number is to monitor the entire exchange from start to finish. This may be complicated by encryption.

You could revisit the site with a monitoring tool to record the session. Note that this is risky and not recommended unless you understand exactly what you're doing. There is a Packet Capture app for Android, which I've used with some success---not sure what the iOS equivalent would be.

You would need an external hardware solution (e.g., a Nemo) to be absolutely confident that you're seeing every single bit the system is sending, but that may be overkill for a case like this.

We cannot assess other communications channels.

In cases like these, your network provider is the one party who knows everyone involved. They have your IP, your MAC address, your IMSI/MSISDN, as well as the identity of the site you browsed.

Unfortunately, there is no way for you to tell independently if/when your provider shares this information. Legal authorities would have to pursue the matter. They have the ability to compel transparency, which may be necessary here.

Improve this answer
1

Not an answer to the question of EE passing information along, but perhaps a way to address it with them in the coming future.

Under the General Data Protection Regulation GDPR, you have the "Right to restrict processing".

Good luck!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .